Your partially correct in your assumption that it was the admin logging in that was triggering the backups, in actual fact it’s the act of anybody visiting your site that will trigger the WordPress cron which in turn runs a backup.

Looking at your backup times I would assume that those times are the times of the first visitor each day.